Memory Acquisition and Virtual Secure Mode
Jason Hale has published a post about the impact of VBS on memory acqusition. With Windows 10 and Server 2016, Microsoft add…
CCF-VM 2.1 has been released
CyLR CDQR Forensics Virtual Machine (CCF-VM) by Alan Orlikoski has been updated to version 2.1. Added TimeSketch!!!! Include…
Scanning Memory with Yara
Memory analysis has been successfully utilized to detect malware in many high profile cases. The use of signature scanning t…
The Sleuth Kit 4.4.2 and Autopsy 4.4.1 have been released
New versions of your favourite open source DFIR tools – the Sleuth Kit and Autopsy, – have been released. The Sl…
Windows MACB Timestamps (NTFS Forensics)
As a continuation of the “Introduction to Windows Forensics” series by Richard Davis, this video introduces the …
WMI Forensics
There are two scripts by David Pany, which can help an analyst to find evidence in WMI repositories: CCM_RUA_finder.py and P…
Understanding lateral movement with Adlumin
In this video lateral movement is explained with help of Adlumin Platform: …
Windows SRUM Forensics
Richard Davis continues his “Introduction to Windows Forensics” series with a video about the System Resource Ut…
Track and Visualize Sysmon Logs with Sysmon View
Sysmon View can help you in tracking and visualizing Sysmon logs. First you should export Sysmon events to an XML file, th…
Recover EXT File Systems with analyzeEXT
Have you ever faced a drive with deleted EXT file system? If yes, there is a really good tool for you – analyzeEXT by …
